Skip to content
Features Pricing Docs Contact Sign In Get Started
Language

Single sign on

Let your staff sign in with their organisation's Microsoft, Google, Okta or Keycloak account.

Single sign on (SSO) lets people sign in to your workspace with the account your organisation already gives them. CommonLynk never sees their password. Passwords keep working while SSO is on, and the workspace owner can always sign in with their own password.

Before you start

CommonLynk switches SSO on for a workspace when you ask. Then the owner finds it under Settings, Single sign on. Only the owner can add a provider, claim a domain or switch a provider on. Administrators can look at the settings and run a test.

  1. Press Add provider, choose your sign in system, and give the values CommonLynk shows to your IT team.
  2. Your IT team creates the application on their side and sends back the values CommonLynk asks for.
  3. Under Domains, add your email domain, publish the DNS TXT record shown beside it, then press Check.
  4. Press Test connection. You sign in at your provider for real, and the page tells you what would happen.
  5. Press Switch on.

Microsoft Entra ID

In the Microsoft Entra admin center, open App registrations and register an application for accounts in this organisational directory only. Add the Redirect URI CommonLynk shows as a Web redirect. Copy the Application (client) ID and the Directory (tenant) ID, and create a client secret under Certificates and secrets. The issuer is https://login.microsoftonline.com/ followed by your tenant ID and /v2.0. Enter the date the secret expires: CommonLynk warns you 30 and 7 days before.

To use SAML instead, create an Enterprise application with SAML, paste the Identifier and the Reply URL CommonLynk shows, and give CommonLynk the App Federation Metadata URL. CommonLynk recognises people by their object ID, never by their email address.

Google Workspace

In the Google Cloud console of your organisation, create an OAuth client of the Web application type and add the Redirect URI CommonLynk shows. Enter your Google Workspace domain too: without it any Google account could sign in, so CommonLynk does not save the provider.

Okta

In the Okta admin console, create an app integration with OIDC as a Web Application, add the Redirect URI, and copy the client ID, the client secret and your Okta address, which is the issuer. For SAML, paste the single sign on URL and the audience CommonLynk shows, and give CommonLynk the metadata URL.

Keycloak

In your realm, create an OpenID Connect client with client authentication on, add the Redirect URI as a valid redirect URI, and copy the secret from the Credentials tab. The issuer is your Keycloak address followed by /realms/ and the realm name. If Keycloak runs on your own private network, ask CommonLynk to allow its address.

Who gets in

A person signs in with SSO when their email address is on one of your verified domains. The first time, CommonLynk creates their account with no role and no access to records, unless the owner chose a role for the provider, and an administrator then gives them what they need. You can allow only people an administrator invited instead. An existing account is linked to the person's work account the first time they sign in; if the provider does not confirm the address, CommonLynk first emails a code to it.

People who sign in with SSO are not asked for a CommonLynk second step: your organisation's own sign in does that. The settings page tells you when your provider does not report two step sign in. While SSO is on, the owner needs two step verification for their own password.

If SSO stops working

The sign in page always has an Owner sign in link that opens the password form. If a secret expires or your provider is down, the owner signs in there and switches the provider off or enters a new secret. Switching a provider off ends every session that signed in through it.